Okta patches Cloud Services after Node.js security releases
Okta and Auth0 report no exploitation evidence and tell customers to move Auth0 Actions to Node 22 and patch SDK runtimes.
52
CVE-2026-123872
Client-cert auth bypass in Node.js TLS 1.2 renegotiation
- CVSS 3.0
- 8.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A flaw in Node.js TLS lets a client that already authenticated with a certificate change the servername during TLS 1.2 renegotiation. On servers that apply different client-certificate policies per hostname, that client can carry its existing authentication onto a stricter host and reach endpoints it was not authorized for. The attacker needs a valid client certificate for a less-restricted host and network access; no user interaction is required. Node.js 26.x, 24.x, and 22.x are affected.
What to do: Apply the Node.js project's security update for CVE-2026-123872. Fixed versions are not stated.
| Product | Affected |
|---|---|
| Node.js | 26.x, 24.x, and 22.x |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Weakness
- CWE-287
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N